Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [lets-encrypt]

Let's Encrypt is a certificate authority that provides free X.509 certificates for TLS encryption.

139
votes
7answers
223k views

How to use Let's Encrypt DNS challenge validation?

Let's Encrypt has announced they have: Turned on support for the ACME DNS challenge How do I make ./letsencrypt-auto generate a new certificate using DNS challenge domain validation? EDIT I mean: ...
79
votes
7answers
113k views

Cron job for let's encrypt renewal

Is this correct way to set cron for renewal of Let's Encrypt cert in Apache2 ? I use Ubuntu 16.04. @monthly letsencrypt renew && service apache2 reload
39
votes
2answers
58k views

Lets Encrypt with an nginx reverse proxy

Introduction I have a dev server (currently running Ubuntu 14.04 LTS), which I have been using for a while now for hosting various development tools on different ports. Because the ports can be hard ...
17
votes
5answers
22k views

SSL & Ngnix: no “ssl_certificate” is defined in server listening on SSL port while SSL handshaking

I have managed to create my certificates with LE with not errors, I have also managed to redirect my traffic from port 80 to port 443. But when i reload my nginx server I am unable to access my ...
16
votes
2answers
2k views

Why not validate self signed certificates through DNS-record instead of letsencrypt

I was just wondering. We use a lot of SSL certificates. Nowadays, we almost exclusively use letsencrypt (thanks!). The bottom line of these certificates is, that proof of ownership of the domain name(...
16
votes
1answer
6k views

Let's Encrypt certbot validation over HTTPS

From the docs of the Certbot webroot plugin The webroot plugin works by creating a temporary file for each of your requested domains in ${webroot-path}/.well-known/acme-challenge. Then the Let’...
14
votes
4answers
11k views

how do I change the admin email for let's encrypt?

The email address used as the admin email when we started using let's encrypt needs to be modified (a former employee used his personal email address as the admin email and he is no longer with the ...
13
votes
5answers
20k views

Nginx disable .htaccess and hidden files but allow .well-known directory

I have a Nginx server, and disabled hidden files in the nginx_vhost.conf ## Disable .htaccess and other hidden files location ~ /\. { deny all; access_log off; ...
11
votes
2answers
23k views

Certbot letsencrypt on different port than 443

I want to set up certbot for a webserver on a different port than 443. I got the following error when running certbot --apache -d <sub>.<domain>.<ext> Failed authorization ...
10
votes
1answer
4k views

Redirect all requests to HTTPS, except for one subdirectory

I'm trying to move from self-signed certificates to Let's Encrypt certificates on my nginx webserver. Currently, I redirect all requests to http/80 to https/443, which uses a self signed certificate ...
8
votes
2answers
7k views

How can I get a Let's Encrypt certificate for a non-public facing server?

I have a private Apache server, reachable only from my LAN on port 443, with a StartSSL certificate. Since Firefox 51 was released, I cannot connect to it any longer as the StartSSL root certificate ...
8
votes
2answers
1k views

Letsencrypt - do I need to keep “.well-known” accessible for certificate renewal?

I created a certificate for my Apache 2.4 server. To validate my server letsencrypt created the folder .well-known and accessed it. Do I need to keep this folder accessible (for certificate renewal) ...
8
votes
1answer
1k views

Use LetsEncrypt certs with Neo4j

How can one use the certificate files generated by LetsEncrypt together with a Neo4j instance? The files generated by LetsEncrypt are: cert.pem chain.pem fullchain.pem privkey.pem I've tried ...
8
votes
2answers
2k views

Using Let's Encrypt inside Docker's official Wordpress container

I'm trying to get Let's Encrypt inside the official Docker Wordpress container. Setup the environment $ cat docker-compose.yml wordpress: hostname: some.fqdn.com image: wordpress links: - ...
7
votes
1answer
5k views

Redirect everything but .well-known in NGINX (Let's Encrypt)

I want to get a certificate via the letsencrypt.sh so I have to provide a challenge on HTTP. Already I use NGINX to forward to SSL (served on a nodejs server). Now I want to still redirect everything ...
7
votes
1answer
3k views

RabbitMQ with a LetsEncrypt certificate

I have been trying to install my LetsEncrypt generated certificates into my rabbitmq server but have had no luck. To test things out with out having to fight permission issues I have copied the pem ...
7
votes
1answer
774 views

SSL alert number 113

We're seeing some errors in the past few days similar to this one, in our nginx error logs: /var/log/nginx/error.log.2.gz:2017/01/30 16:11:46 [crit] 13114#13114: *139338 SSL_do_handshake() failed (...
7
votes
1answer
733 views

Utilizing SSL on Multi-domain, Autoscaling Elastic Beanstalk Setup

We are creating a Content Management System for our company. It is important that this CMS support dynamic domain names on a dynamic number of servers. After many hours of research we felt that Amazon'...
6
votes
4answers
4k views

Let's Encrypt SSL Certificate File Not Found Error, but still working

I'm running SSL Certificates from Let's Encrypt. I've got them installed on my Ubuntu machine running Apache. The setup works fine and I can launch the website, see the green padlock and even got an A+...
6
votes
1answer
5k views

Renew letsencrypt certificate on Apache httpd

I'm using certbot --webroot plugin and certbot renew to renew the certificate, which does work, but it looks like httpd is caching the certificate and does not "see" that it's been updated. Is there ...
6
votes
1answer
1k views

Why does certbot suddenly fall back to http-01 challenge instead of tls-sni-01 (https)?

I have a well-tested bash script that was running fine until a few weeks ago. It seems that certbot challenge defaults now to http instead of https. I can't figure out the reason. echo 'rsa-key-size =...
6
votes
3answers
2k views

configure CouchDB with Lets Encrypt SSL certificate

What i would like to do: Now I'm using a self signed SSL certificate which works wonderful. But I would like to replace them with an official one of lets encrypt. What i have (self signed certificate)...
6
votes
2answers
2k views

Use Letsencrypt certificates for Postgresql

I have successfully configured Letsencrypt for my NGINX webserver on Debian 8 Jessie. Now I have installed Postgresql 9.4 and want to use the LE certificates (in /etc/letsencrypt/live/mydomain/com/......
5
votes
3answers
7k views

Lets Encrypt OpenVPN AS

I've got an OpenVPN AS running and I am trying to setup SSL certs (running ubuntu) from letsencrypt. I've managed to get my certificates from letsencrypt (using letsencrypt standalone) and I was ...
5
votes
1answer
295 views

Let's encrypt SSL certificate for new server

my domain example.com is currently pointing to a server with an alphassl certificate. I want to point this domain to my new server (by changing the nameservers) without any timeout of https. So I want ...
5
votes
1answer
2k views

gitlab SSL configuration / certificate verification failed

I have my own gitlab server, now secured with an letsencrypt SSL certificate. Now, I want to publish some packages via packagist. But when I enter the git repository url in packagist, I got the ...
5
votes
1answer
7k views

Let's Encrypt certbot - add a new domain to certificate

I have certbot installed and it created a certificate for a few domains that I host and that's working - I got a single certificate that covers all the domains. Now I want to add a new domain to the ...
5
votes
3answers
1k views

How can I use Let's Encrypt (letsencrypt.org) as a free SSL certificate provider?

I have a few sites running with a StartSSL free certificate (CJSHayward.com, JobhuntTracker.com), and Firefox rejects StartSSL and displays an error page saying that my server is not properly ...
5
votes
1answer
16k views

Renew domains using certbot and using DNS challenge

I created several SSL certificates for several domains using the standalone method. I am only interested in the certificates, without server integration. They are now for renewal. So, I ran: certbot ...
5
votes
1answer
4k views

How to fix issues with LetsEncrypt certificate chains on Windows Server?

I've been using LetsEncrypt to generate certificates for my sites on Windows 2012 R2 server. It worked great, until recently when I renewed the certificates. LetsEncrypt made a recent change where ...
5
votes
2answers
3k views

Let's Encrypt — “DNS … query timed out looking up CAA for …”

I have been using Let's Encrypt on a few domains for a couple of months now, and it generally has been working. I was going through renewing the certs, and for one of the domains I get the following ...
4
votes
3answers
2k views

Certbot fails. Enable Let’s Encrypt certbot on a new server that will replace the existing production server

I have an nginx web server with an SSL certificate provided by Let’s Encrypt using Certbot. For example, this site is publically available at https://example.com New server I’m creating a new server ...
4
votes
2answers
3k views

Letsencrypt renewal getting - remote error: tls: handshake failure

I'm trying to renew my letsencrypt certs and getting the following error: remote error: tls: handshake failure How do I fix this?
4
votes
3answers
15k views

LetsEncrypt certificate renewal failure

I tried to renew the certificate of my server. The current one has expired 1 month ago, but I didn't took care of it until now. I tried to use the letsencrypt-auto renew command but got a failure: ...
4
votes
1answer
1k views

Let's Encrypt using webroot on nginx with an SSL redirect

I have a web site being served with nginx with the following requirements: Redirect all http -> https Zero-downtime Let's Encrypt certificate renewal In order to satisfy (1) I have a small http->...
4
votes
2answers
3k views

Let's Encrypt DNS challenge with multiple public DNS providers

We use two DNS providers for redundancy. Since the DynDNS DDOS attack of 2016, I expect we are not alone in this practice. I am attempting to use the Let's Encrypt certbot with DNS challenge. Having ...
4
votes
1answer
15k views

Verify return code: 21 (unable to verify the first certificate) Lets encrypt Apache to Nginx with crontab issue

I did this https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04 then switch from apache to nginx with the following ***https://www.digitalocean....
4
votes
1answer
1k views

apache 2.4 + gitlab + letsencrypt not working

I use the following config to enable letsencrypt support on all vhosts: ProxyPass /.well-known/acme-challenge ! Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/ &...
4
votes
1answer
3k views

Use Let's Encrypt certificate for mail server

I currently have a free StartSSL certificate for my mail server (postfix/dovecot). Of course, it works fine but Let's Encrypt certificates are easier and faster to work with. My Apache server also ...
4
votes
1answer
753 views

Let's Encrypt: Why is DNS challenge static? [closed]

To my understanding, LetsEncrypt DNS verification works by setting a static TXT record into DNS (basically just a nonce) which is then checked by the LetsEncrypt servers. When I first heard about it ...
4
votes
1answer
847 views

Use letsencrypt on virtual machine behind a reverse proxy with server name indication

I have a server set up with some virtual machines behind a nat. I want to use encryption for my xmpp-server-vm, and therefore need a certificate inside the vm. Is there a possibility to use nginx as a ...
4
votes
1answer
104 views

Let's Encrypt w/ Apache 2.4.23 on Arch Linux produces “can't connect” error

I have a fully updated Arch Linux server running Apache 2.4.23. In the past I've successfully used StartSSL to enable HTTPS on my Apache web server. But now I'd like to switch to Let's Encrypt. ...
4
votes
1answer
538 views

Let's Encrypt and local puppet development

I develop Puppet manifests in a Vagrant VM. I'd like to configure an SSL-terminating webserver, but obviously Let's Encrypt verification will fail when the node is only running on my laptop. Is ...
4
votes
0answers
86 views

How to make Certbot ignore a particular domain in nginx?

I have ~30 domains running on my server, all of them with SSL certificates managed by the Certbot nginx plugin. All of them, except one... let's call it selfsigned.example.com. This domain uses a ...
3
votes
1answer
1k views

Do I need to have port 80 configured in LAMP for an HTTPS website?

I have a LAMP webserver, and on it there is https://sslhosting.cz/ domain. First I attach a general Let's Encrypt config file, which I changed to my needs: /etc/letsencrypt/options-ssl-apache.conf #...
3
votes
1answer
2k views

LetsEncrypt: Unknown SSL protocol error in connection

I have a host with LE certificate and it works well in a browsers, but I still can't connect using curl, openssl, wget, POST (libwww-perl): curl # curl -v -3 https://example.com/ * Hostname was NOT ...
3
votes
3answers
4k views

Error installing LetsEncrypt SSL: (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain

I am trying to install LetsEncrypt on my server (which I have root SSH access to), for staging.dnslaude.com - which is a publicly accessible domain, pointing to 213.212.81.89. The server is running ...
3
votes
1answer
3k views

Trying to get 100% in ssllabs.com key exchange

I wanted to know what steps are needed to get 100% on every category in ssllabs.com. I am aware that this could lead to problems in older systems, but I dont care. My letsencrypt.org certificate ...
3
votes
3answers
3k views

How to grant access to “/.well-known” directory on SVN server (Apache 2.2)

I cannot figure out how to disable authentication for the .well-known directory. Things behave as expected when I remove the SVN specific directives (DAV, SVNPath, AuthzSVNAccessFile). <...
3
votes
3answers
2k views

Does order of lines matter in Nginx?

I have a server file like this server { listen 80; server_name subdomain.example.com; return 301 https://$server_name$request_uri; location /.well-known/acme-challenge { root /var/www/...